Comprehensive state privacy law
Oregon privacy law
Oregon Consumer Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- ORS 646A.570 to 646A.589
- Enacted
- July 18, 2023. Oregon Laws 2023, chapter 369 (SB 619)
- In force
- July 1, 2024
- Effective dates
- July 1, 2024: main provisions operative (2023 c.369 § 15(1)); data protection assessments apply to processing on and after this date (ORS 646A.586(5))
- July 1, 2025: nonprofit organizations under IRC 501(c)(3) covered (2023 c.369 § 13 delayed them until this date)
- January 1, 2026: opt-out preference signals must be honored (2023 c.369 § 12 and § 15(2)); HB 2008 bans on selling under-16 and precise geolocation data and on targeted advertising or profiling of under-16s take effect (2025 c.251); general 30-day cure period ended (2025 c.417 § 5(2))
- July 1, 2026: temporary cure provision (2025 c.417 § 5), by then limited to certain noncommercial educational broadcast stations, repealed (2025 c.417 § 6)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. The act and other Oregon laws create no private right of action to enforce it (ORS 646A.589(7)).
- Cure period
- Ended January 1, 2026. Until 31 December 2025 the Attorney General had to give a controller 30 days to cure a curable violation before suing. From 1 January 2026 that applies only to certain noncommercial educational broadcast stations, and the provision is repealed on 1 July 2026. For other controllers there is no cure period now. (2025 c.417 § 5 (note after ORS 646A.589))
- Rulemaking
- No. The act grants no rulemaking power. The Department of Justice publishes guidance.
Amendments
- Oregon Laws 2024, chapter 64 (SB 1576) (in force March 27, 2024). Technical wording change to ORS 646A.589 (who at the Department of Justice may see confidential investigation materials); no change to duties.
- Oregon Laws 2025, chapter 417 (SB 1121) (in force June 24, 2025). Restructured the cure period: the Attorney General must give 30 days to cure when a violation is curable, but from 1 January 2026 only for certain noncommercial educational broadcast stations; that provision is repealed on 1 July 2026. Also made the 2023 enforcement amendments operative on 24 June 2025.
- Oregon Laws 2025, chapter 163 (HB 3875) (in force September 26, 2025). Applies the act to motor vehicle manufacturers and their affiliates that process personal data from a consumer's use of a vehicle, regardless of the volume thresholds.
- Oregon Laws 2025, chapter 251 (HB 2008) (in force January 1, 2026). Bans selling personal data of consumers known to be under 16 and selling precise geolocation data (within 1,750 feet); bans targeted advertising and significant profiling of consumers known to be under 16 (previously allowed with consent for ages 13 to 15).
Topics
- ApplicabilityThe act covers persons doing business in Oregon, or providing products or services to residents, that in a calendar year control or process personal data of 100,000 or more consumers (payment-only data excluded), or 25,000 or more while deriving 25% or more of annual gross revenue from selling personal data. Since 26 September 2025 it also covers motor vehicle manufacturers and affiliates processing vehicle-use data, whatever the volume. Nonprofits are covered (501(c)(3) organizations from 1 July 2025); the GLBA exemption is data-level, with entity exemptions for financial institutions as defined by Oregon law and insurers.
- Consumer rightsConsumers may confirm processing and the categories processed, obtain (at the controller's option) a list of specific third parties that received their data or any data, get a portable copy, correct, delete (including derived data and data from other sources), and opt out of targeted advertising, sale and significant profiling. Controllers answer within 45 days, extendable once by 45 days, and the first request in 12 months is free. Appeals must be decided within 45 days, with a route to the Attorney General on denial.
- Sensitive dataSensitive data includes racial or ethnic background, national origin, religious beliefs, health, sexual orientation, transgender or nonbinary status, status as a crime victim, citizenship or immigration status, a child's data, precise geolocation and genetic or biometric data. Processing it requires prior consent, and a known child's data must follow COPPA. Since 1 January 2026 a controller may not sell precise geolocation data or the data of a consumer it knows (or wilfully disregards) is under 16, and may not use such a consumer's data for targeted advertising or significant profiling, even with consent.
- Controller dutiesControllers must state express purposes, limit collection to what is adequate, relevant and reasonably necessary, and apply the security safeguards of ORS 646A.622. The privacy notice must list categories of data and sensitive data, purposes, rights and appeals, data shared and detailed categories of third parties, a monitored contact, the controller's registered and assumed business names, and opt-out procedures. Data protection assessments are required for heightened-risk processing from 1 July 2024 and kept five years; opt-out preference signals must be honored from 1 January 2026.
- ProcessorsProcessors must follow instructions, help with consumer requests and assessments, and adopt reasonable safeguards. The contract must be binding and set out instructions, nature and purpose, data types and duration, and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, subcontracts that flow down obligations, and assessments by the controller or an independent assessor.
- EnforcementThe Attorney General has exclusive enforcement authority, may serve investigative demands and may seek a civil penalty of up to $7,500 per violation, injunctions and fees. The general 30-day cure period ended on 1 January 2026. There is no private right of action, and actions must be brought within five years of the last violating act.
Sources
- ORS chapter 646A (2025 edition), ORS 646A.570 to 646A.589 with notes
- Oregon Laws 2023, chapter 369 (SB 619)
- Oregon Laws 2024, chapter 64 (SB 1576)
- Oregon Laws 2025, chapter 163 (HB 3875)
- Oregon Laws 2025, chapter 251 (HB 2008)
- Oregon Laws 2025, chapter 417 (SB 1121)
- Oregon Department of Justice, Privacy page
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Oregon statute
Reference material, not legal advice.